CVE-2025-31493

Executive Summary

CVE-2025-31493 is a critical path traversal vulnerability in Kirby CMS that allows attackers to read and execute arbitrary files on the server. The flaw exists in the collection() helper and $kirby->collection() method when used with dynamic collection names derived from user input (e.g., collection('tags-' . get('tags'))). A missing path traversal check enables attackers to navigate outside the collections root directory, accessing sensitive files like configuration files, source code, or PHP files that get executed. This can lead to full server compromise, data theft, and code execution. The vulnerability is patched in Kirby 3.9.8.3, 3.10.1.2, and 4.7.1.

Supply Chain & Package Security

Kirby CMS is a PHP-based content management system distributed via its official website and Composer. The vulnerability affects all installations using dynamic collection names. Users should update to the patched versions immediately. No malicious packages have been reported in the supply chain.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – PHP code execution possible.
• Availability (A): High (H) – Could lead to denial of service or system compromise.

CVSS Score: 9.8 (Critical)

Threat Level: Critical – Exploitation can lead to complete server takeover.

Deep Dive & Mechanics

The vulnerability resides in the collection() helper and $kirby->collection() method. When a dynamic collection name is used (e.g., from GET/POST parameters), the code does not properly sanitize the path. An attacker can inject path traversal sequences like ../ to navigate outside the collections root directory.

Example vulnerable call:

collection('tags-' . get('tags'));

If an attacker sends ?tags=../../etc/passwd, the resulting path becomes tags-../../etc/passwd, which resolves to /etc/passwd on the server. The file is then read and, if it contains PHP code, executed.

Root Cause: Missing validation that the resolved path stays within the configured collections root directory.

Attack Scenario:

1. Attacker identifies a Kirby site using dynamic collection names.
2. Attacker sends a crafted request with path traversal sequences.
3. The server reads and executes arbitrary files, leading to information disclosure or code execution.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// Kirby/src/Cms/App.php (simplified)
public function collection(string $name): ?Collection
{
    $file = $this->root('collections') . '/' . $name . '.php';
    if (file_exists($file)) {
        return include $file;
    }
    return null;
}

No path validation is performed on $name.

Patched Code (after patch):

// Kirby/src/Cms/App.php (simplified)
public function collection(string $name): ?Collection
{
    $root = $this->root('collections');
    $file = realpath($root . '/' . $name . '.php');
    if ($file === false || strpos($file, realpath($root)) !== 0) {
        return null; // Path traversal detected
    }
    if (file_exists($file)) {
        return include $file;
    }
    return null;
}

The patch uses realpath() to resolve the path and checks that it starts with the collections root directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Kirby site with a vulnerable endpoint using dynamic collection names.
• Knowledge of the server's file system (or fuzzing to discover paths).

Exploit Steps:

1. Identify a vulnerable parameter (e.g., ?tags= in a URL).
2. Craft a payload to read sensitive files:

   GET /?tags=../../etc/passwd HTTP/1.1
   Host: target.com
   

3. For PHP code execution, target a PHP file outside the collections root:

   GET /?tags=../../var/www/html/shell HTTP/1.1
   Host: target.com
   

   (Assuming shell.php exists and contains PHP code.)

No public exploit code is available.

Blue Team (Detection & Defense)

Detection:

• Monitor for path traversal patterns in request parameters (e.g., ../, ..\\).
• Look for unexpected file reads or includes in server logs.
• Use WAF rules to block path traversal sequences.

Defense:

• Update Kirby to patched versions (3.9.8.3, 3.10.1.2, 4.7.1).
• Avoid using dynamic collection names; use static strings instead.
• Implement input validation and sanitization for all user-supplied data.
• Restrict file system permissions to limit the impact of path traversal.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or ..\\ in parameters.
  • Requests to endpoints using collection() with suspicious parameters.
• File System IOCs:
  • Unexpected files accessed outside the collections root.
  • Presence of PHP shells or backdoors in web-accessible directories.
• Log IOCs:
  • Error logs showing attempts to include files outside the collections root.
  • Access logs with unusual file paths.

Detection Engineering

YARA Rule

rule CVE_2025_31493_Kirby_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Kirby CMS collection() calls"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-31493"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $php_ext = ".php"
    condition:
        any of ($traversal*) and $php_ext
}

Sigma Rule

title: CVE-2025-31493 Kirby CMS Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Kirby CMS collection() calls
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of dots in parameters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-31493 Kirby CMS Path Traversal"; flow:to_server,established; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Kirby to version 3.9.8.3, 3.10.1.2, or 4.7.1.
2. Review all uses of collection() and $kirby->collection() for dynamic input.
3. Implement input validation to reject path traversal sequences.

Long-Term Mitigations:

• Use static collection names whenever possible.
• Apply principle of least privilege to the web server user.
• Deploy a Web Application Firewall (WAF) with rules to block path traversal.
• Conduct regular security audits and penetration testing.

Patch Verification:

• After updating, verify that the realpath() check is present in the collection method.
• Test with path traversal payloads to ensure they are blocked.

Valters IT
DevSecOps & Cyber Threat Intelligence
Securing digital landscapes with precision and expertise.